FedRAMP Moderate

Moderate impact is where most federal cloud services live, including the ones that added an assistant this year. The baseline expects steady monitoring and prompt remediation rather than a single point of proof. This starter provides control coverage and evidence inputs for one traffic path, and no authorization.

Continuous monitoring is the usual pressure point. An assessor wants current evidence rather than a snapshot from a good week. A traffic path that behaves the same way every day is easier to defend than a written promise.

Identity comes with a hardware credential requirement. A call must carry verified user and organization claims and a personal identity verification header, or it never reaches the model. Redaction then masks matter numbers, taxpayer identification numbers and records request numbers.

The same request also passes a marking block list. That list refuses controlled unclassified information, official use only text and sensitive but unclassified content. Tool calls are limited to document search and regulation lookup, with three actions allowed in a session.

An answer below 0.85 combined quality or 0.85 accuracy does not reach the caller. Neither does an answer that passes, because the review stage sends all of them to a reviewer instead. Your monitoring program gains a record of human judgment for each request, and the assistant produces no text of its own.

Remediation timelines, configuration baselines and monthly reports remain program work. This starter narrows the control map for one path and offers material an assessor can read. It is not an authorization, and it does not speak for a sponsoring agency.